Saudi PDPL: What It Is and Who It Applies To

What is the Saudi PDPL?

It is a law, not a voluntary framework. The Bureau of Experts lists the Law as in force. It leaves many details, such as conditions of consent and response deadlines, to Implementing Regulations.

The Law was issued in Arabic, and the Bureau of Experts page used here carries only the Arabic text. The English wording below is this page's own translation, so check it against the Arabic.

Who and what does the PDPL apply to?

Article 2 applies the Law to any processing of personal data relating to individuals that takes place in the Kingdom, by any means. It includes processing of data about individuals residing in the Kingdom by any party outside the Kingdom, and data of a deceased person if it would identify him or a family member specifically.

Individuals processing data only for personal or family use are outside the Law, unless they publish or disclose it to others.

Key terms in Article 1:

• Personal data: any data, whatever its source or form, that identifies an individual specifically or makes identification possible, directly or indirectly.
• Sensitive data: includes data on racial or ethnic origin, religious, intellectual or political belief, security and criminal data, biometric identifiers, genetic data and health data.
• Controller: any public entity, or any individual or private legal entity, that determines the purpose and manner of processing, whether it processes itself or through a processor.
• Processor: any public entity, or any individual or private legal entity, that processes personal data for a controller and on its behalf.

What rights do individuals have under the PDPL?

Article 4, as amended, gives individuals five rights, subject to the Law and the Regulations:

• to be informed of the legal basis and purpose of collecting their data;
• to access their data held by a controller, under rules the Regulations set;
• to request their data in a readable and clear form;
• to request correction, completion or update; and
• to request destruction of data no longer needed, without prejudice to Article 18.

What must organisations that control personal data do?

The Law's main duties for controllers include:

• Consent (Articles 5 and 6): process data only with the individual's consent, which can be withdrawn at any time, unless an exception applies. Exceptions include processing required by another law, and processing necessary for a controller's legitimate interests, but only where that does not prejudice the individual's rights or conflict with their interests and the data is not sensitive data (Article 6(4)).
• Collection (Articles 10 and 11): collect directly from the individual and use data only for the purpose collected, with listed exceptions to each rule, and collect only the minimum necessary.
• Transparency (Articles 12 and 13): adopt a privacy policy and make it available to individuals when collecting their data. When collecting data directly from the individual, take adequate means to inform them of matters that include the legal basis, the purpose, whether collection is mandatory, who will receive the data and whether it will leave the Kingdom.
• Processors (Article 8): choose processors that give the necessary guarantees, and verify their compliance.
• Retention (Article 18): destroy data without delay once its purpose ends, with listed exceptions.
• Security (Article 19): take organisational, administrative and technical measures to protect data, including in transit.
• Records and assessments (Articles 22 and 31): keep records of processing activities, and assess the impact of processing for products or services offered to the public.
• Protection officer (Article 30): appoint a person for this role in cases the Regulations set.

What does the PDPL say about transferring personal data outside Saudi Arabia?

Article 29, as amended, lets a controller transfer or disclose personal data outside the Kingdom for listed purposes. These are performing an obligation under an agreement the Kingdom is party to, serving the Kingdom's interests, performing an obligation the individual is party to, or other purposes the Regulations set.

Conditions include no harm to national security or vital interests, protection abroad no lower than under the Law (based on an assessment by the competent authority), and only the minimum data needed. Cases of extreme necessity for life or vital interests are carved out of these conditions.

What does the PDPL say about data breaches?

Under Article 20, as amended, a controller notifies the competent authority when it learns of a leak, damage or unlawful access, as the Regulations determine. It also notifies the individual if the incident would harm their data or conflict with their rights or interests, again as the Regulations determine. The Law itself sets no number of hours.

SDAIA's online breach-notification service describes reporting a personal data leak incident "within a period not exceeding (72) hours" of becoming aware, where the incident would harm the personal data or the individual or conflict with their rights or interests, citing Article 24 of the Implementing Regulation. The Regulation text itself was not read for this page, so confirm the period and the conditions there.

Who enforces the PDPL, and what are the penalties?

The Law defines the "competent authority" as the body a Council of Ministers decision designates, and Article 30(1) makes it the supervising body, without prejudice to the powers of the Saudi Central Bank. The Cabinet decision approving the Law named the Saudi Data and Artificial Intelligence Authority (SDAIA) for two years, during which moving supervision to the National Data Management Office was to be considered. SDAIA's own platform says it is used to enforce the Law and that SDAIA receives complaints under it (Article 34).

The approving decree also says the Law does not prejudice the powers of the National Cybersecurity Authority (see NCA ECC). See also the SAMA Cyber Security Framework.

Penalties apply only from the Law's commencement (see the last section, including the adjustment period the approving decree gave controllers), and are without prejudice to any more severe penalty in another law:

• Article 35(1): disclosing or publishing sensitive data in breach of the Law, with intent to harm the individual or for personal benefit, carries imprisonment of up to two years and/or a fine of up to SAR 3 million; the court may double the fine for a repeat offence (Article 35(4)).
• Article 36(1): other violations by a covered person carry a warning or a fine of up to SAR 5 million, which may be doubled for repeat violations.

When did the PDPL take effect?

Article 43, as amended, says the Law takes effect 720 days after its publication in the Official Gazette. The Bureau of Experts records the publication date as 24 September 2021 (17/2/1443H). Counting 720 days from that date gives 14 September 2023 (a derived date: this page's own calculation, not a date stated in the Law).

The approving decree gave controllers up to one year from the effective date to adjust their position, and allowed the competent authority to grant extra time to some entities. Confirm dates with a Saudi legal adviser. This page is general information, not legal advice.

Is the Saudi PDPL a law or a framework?

It is a law, approved by Royal Decree No. M/19 of 9/2/1443H and amended by Royal Decree No. M/148 of 5/9/1444H.

Does the PDPL apply to companies outside Saudi Arabia?

Article 2 covers processing of personal data about individuals residing in the Kingdom by any party outside the Kingdom.

Does the PDPL always require consent?

Consent is the general rule in Article 5, with exceptions in Article 6. They include processing required by another law and processing necessary for the controller's legitimate interests, where that does not prejudice the individual's rights or conflict with their interests and the data is not sensitive.

What penalties does the PDPL set?

Article 35(1) sets up to two years' imprisonment and/or a fine of up to SAR 3 million for disclosing or publishing sensitive data in breach of the Law with intent to harm or for personal benefit. Article 36(1) sets a warning or a fine of up to SAR 5 million for other violations by a covered person. Fines may be doubled for repeat violations (Articles 35(4) and 36(1)). These apply only from the Law's commencement; see the section on when the PDPL took effect for the derived date and the adjustment period.

How soon must a breach be reported?

The Law leaves timing to the Regulations. SDAIA's notification service describes reporting within 72 hours of becoming aware, for incidents that would harm the personal data or the individual or conflict with their rights or interests, citing Article 24 of the Implementing Regulation. Confirm the period and the conditions in the Regulation.

Which text is authoritative?

The Law was issued in Arabic. The English on this page is a translation by the page's author, so rely on the Arabic text.